In CISA KEVNot scored
CVE-2026-21533
Microsoft Windows Improper Privilege Management Vulnerability
MicrosoftWindows
Status
- Exploited in the wild
- In CISA KEV since 10 Feb
Federal deadlineTue 3 Mar, 23:59 UTC
Passed 235 days ago
CISA KEV · added 10 Feb
Exploit probabilityEPSSchecked 4 Sep
3.9%probability of exploitation in the next 30 days
Higher than 89% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 7 articles · 6 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 10 Feb · 19:40 UTC | SecurityWeek | 6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 Updates |
| Tue 10 Feb · 22:30 UTC | Krebs on Security | Patch Tuesday, February 2026 Edition |
| Tue 10 Feb · 23:35 UTC | Security Affairs | Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-days |
| Wed 11 Feb · 04:35 UTC | SecurityOnline | Patch Panic: Microsoft Fixes 6 Active Zero-Days in Feb 2026 Update |
| Wed 11 Feb · 08:25 UTC | Security Affairs | U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog |
| Wed 11 Feb · 12:40 UTC | Malwarebytes | February 2026 Patch Tuesday includes six actively exploited zero-days |
| Wed 11 Feb · 14:20 UTC | SOCRadar | February 2026 Patch Tuesday: Six Active Zero-Days & 53 Other Flaws Addressed |
- February 2026 Patch Tuesday: Six Active Zero-Days & 53 Other Flaws AddressedSOCRadar · mentions it in passing
- February 2026 Patch Tuesday includes six actively exploited zero-daysMalwarebytes · mentions it in passing
- U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- Patch Panic: Microsoft Fixes 6 Active Zero-Days in Feb 2026 UpdateSecurityOnline · mentions it in passing
- Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-daysSecurity Affairs · mentions it in passing
- Patch Tuesday, February 2026 EditionKrebs on Security · mentions it in passing
- 6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 UpdatesSecurityWeek · first in our coverage · mentions it in passing